CVE-2026-75908— Newsletters <= 4.17 - Missing Authorization to Authenticated (Author+) Arbitrary Modification via 'newsletters_mailinglistsroles' POST Parameter
Quick assessment
Affected
contrid Newsletters
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WordPress Newsletters 插件在所有 4.17 及更早版本中存在授权绕过漏洞。该漏洞是由于插件未正确验证用户是否有权执行特定操作所致。因此，具备作者级（author）及以上权限的已认证攻击者，可以在正常帖子提交过程中伪造 POST 字段，从而向任何 WordPress 角色（包括管理员）的用户发送任意新闻邮件。攻击者可通过 POST 字段传入角色 slug，并将其直接传递给 函数，导致未经授权的大规模邮件发送，并可能利用网站自身的出站邮件通道对特权用户进行钓鱼攻击。
Possible ATT&CK Techniques 3 AI
T1098 · Account Manipulation T1534 · Internal Spearphishing T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| contrid | Newsletters | ≤ 4.17 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-75908
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Newsletters <= 4.17 - Missing Authorization to Authenticated (Author+) Arbitrary Modification via 'newsletters_mailinglistsroles' POST Parameter
Source: CVE Program / CVE List V5
Vulnerability Description
The Newsletters plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.17. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with author-level access and above, to send arbitrary newsletter emails to users of any WordPress role, including administrators, by forging POST fields during a normal post submission. This allows an attacker-supplied role slug via the newsletters_mailinglistsroles POST field to be passed directly to get_users(), enabling unauthorized mass-mailing and potential phishing against privileged site users through the site's own outbound email channel.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| contrid | Newsletters | 0 ~ 4.17 | - |
|
II. Public POCs for CVE-2026-75908
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-75908
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-75908 (1)
Vendor Advisories for CVE-2026-75908 (1)
Vendor Pages for CVE-2026-75908 (1)
Other References for CVE-2026-75908 (3)
IV. Related Vulnerabilities
Same product: Newsletters
-
CVE-2026-16267
Newsletters < 4.16 - Unauthenticated PHP Object Injection vi -
CVE-2026-16269
Newsletters < 4.16 - Unauthenticated API Authentication Bypa -
CVE-2026-16268
Newsletters < 4.16 - Unauthenticated Server-Side Request For -
CVE-2026-12938
Newsletters <= 4.15 - Authenticated (Contributor+) Stored Cr -
CVE-2026-12939
Newsletters <= 4.15 - Authenticated (Contributor+) Stored Cr
Same vendor: contrid
-
CVE-2026-12939
Newsletters <= 4.15 - Authenticated (Contributor+) Stored Cr -
CVE-2026-12938
Newsletters <= 4.15 - Authenticated (Contributor+) Stored Cr -
CVE-2026-2021
Slideshow Gallery LITE <= 1.8.5 - Authenticated (Contributor -
CVE-2026-3018
Newsletters <= 4.13 - Unauthenticated SQL Injection via wpml -
CVE-2025-4857
Newsletters <= 4.9.9.9 - Authenticated (Administrator+) Loca
Same weakness: CWE-862
V. Comments for CVE-2026-75908
No comments yet